Every CVE Search/ Get API key

CVE-2026-110654

libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs

6.9 MediumFix available

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.17%Unchanged since Oct 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
CVE-2026-110654
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-101127 6.9

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
EUVD-2026-101127
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pw98-3fpx-6f7v 6.9

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that...

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
GHSA-pw98-3fpx-6f7v
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 6.9

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
CVE-2026-110654
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 6.9

libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
CVE-2026-110654
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-03
OSVDEBIAN-CVE-2026-110654 6.9

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
DEBIAN-CVE-2026-110654
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 4 moreShow less
OSVOESA-2026-4693 6.9

zvbi security update

The ZVBI library provides functions to read from Linux V4L, V4L2 and FreeBSD BKTR raw VBI capture devices, from Linux DVB devices and from a VBI proxy to share V4L and V4L2 VBI devices between multiple applications. It can demodulate raw to sliced VBI data in software, with support for a wide range of formats, has functions to decode several popular services including Teletext and Closed Caption, a Teletext cache with search function, various text export and rendering functions.

Security Fix(es):

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.(CVE-2026-110654)

Record
OESA-2026-4693
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-04
OSVUBUNTU-CVE-2026-110654 6.9

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
UBUNTU-CVE-2026-110654
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVMGASA-2026-0576 No score

Updated zvbi package fixes a security vulnerability

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.

Record
MGASA-2026-0576
Updated
2026-11-05
OSVopenSUSE-SU-2026:12394-1 No score

libzvbi-chains0-0.2.46-2.1 on GA media

These are all security issues fixed in the libzvbi-chains0-0.2.46-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12394-1
Updated
2026-11-03

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zvbi
Debian:12
 All versions, plus listed versions
0.2.41-10.2.41-1+deb12u10.2.41-20.2.42-10.2.42-1.1
Show 10 moreShow less
0.2.42-1.20.2.42-1.2~exp10.2.42-20.2.43-10.2.43-1+hurd.10.2.43-20.2.44-10.2.44-20.2.45-10.2.46-1
 None known
zvbi
Debian:13
 All versions, plus listed versions
0.2.44-10.2.44-20.2.45-10.2.46-1
 None known
zvbi
Debian:14
 before 0.2.46-1, plus listed versions
0.2.44-10.2.44-20.2.45-1
0.2.46-1
zvbi
Mageia:10
 before 0.2.44-3.mga10
0.2.44-3.mga10
zvbi
openEuler:24.03-LTS-SP3
 before 0.2.44-3.oe2403sp3
0.2.44-3.oe2403sp3
zvbi
Ubuntu:14.04:LTS
 All versions, plus listed versions
0.2.33-70.2.35-2
 None known
zvbi
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.2.35-90.2.35-100.2.35-10ubuntu0.1~esm1
 None known
zvbi
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.2.35-130.2.35-13ubuntu0.1~esm1
 None known
zvbi
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
0.2.35-160.2.35-170.2.35-17ubuntu0.1~esm1
 None known
zvbi
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
0.2.35-180.2.35-190.2.35-19ubuntu0.1~esm1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
zvbi
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
0.2.41-20.2.42-10.2.42-1.10.2.42-1.20.2.42-20.2.42-2ubuntu0.24.04.1~esm1
 None known
zvbi
Ubuntu:26.10
 All versions, plus listed versions
0.2.44-1ubuntu20.2.44-2ubuntu10.2.45-1
 None known
zvbi
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.2.44-1ubuntu10.2.44-1ubuntu2
 None known
zvbi
openSUSE:Tumbleweed
 before 0.2.46-2.1
0.2.46-2.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, facts, referencesOSV
affected, aliases, references
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-110654 is a medium vulnerability (CVSS 6.9) in Zapping-vbi Libzvbi, published October 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in zvbi 0.2.46-1.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open